Services on Demand
Journal
Article
Indicators
- Cited by SciELO
- Access statistics
Related links
- Cited by Google
- Similars in SciELO
- Similars in Google
Share
Journal of the Brazilian Computer Society
Print version ISSN 0104-6500On-line version ISSN 1678-4804
J. Braz. Comp. Soc. vol. 4 no. 2 Campinas Nov. 1997
https://doi.org/10.1590/S0104-65001997000300002
A Fault Tolerant Colored Petri Net Model for Flexible Manufacturing Systems
Tomaz C. Barros^{*} Departamento de Eletrônica e Sistemas Universidade Federal de Pernambuco Caixa Postal 7800, 50711-970 Recife - PE - Brazil tomaz@dee.ufpb.br | Jorge C.A. de Figueiredo Departamento de Sistemas e Computação Universidade Federal da Paraíba Caixa Postal 10105, 58109-970 Campina Grande - PB - Brazil abrantes@dsc.ufpb.br | |
Angelo Perkusich Departamento de Engenharia Elérica Universidade Federal da Paraía Caixa Postal 10105, 58109-970 Campina Grande - PB - Brazil perkusic@dee.ufpb.br | ||
Abstract | This paper introduces an approach based on Colored Petri Nets (CPN) to systematically introduce fault-tolerance in the design of a supervisor for a Flexible Manufacturing System (FMS). The system is modeled by means of Place/Transition nets and then is structurally reduced, resulting in a CPN that is independent of a specific production route. The introduction of fault tolerance in the design of such a supervisor considers both forward recovery and backward recovery. For forward recovery we anticipate faults in resources in a production route and reschedule the production routes for production orders before the faulty resource is reached. The backward recovery is considered at the level of a resource in such a way that when a faulty resource is fixed, the operation restarts on the last consistent operation executed. Keywords: Fault Tolerance, Forward Recovery, Backward Recovery, Flexible Manufacturing Systems, Colored Petri Nets. |
1 Introduction
Flexible Manufacturing Systems (FMS) are complex systems made up of manufacturing cells with different kinds of resources. These resources may be one or more machines, e.g. drilling machines, lathes: Between cells and machines there is a flow of semi finished products (in the remainder of the paper the term sub-product will be employed) or raw material that may be transported by either robots or automated guided vehicles [2]. The raw material or sub-products are processed by the resources resulting in a certain kind of product. Each cell or machine must be capable of manipulating different sub-products, resulting in some final finished product. This flexibility introduces a significant degree of complexity to allocate and manage the resources required to produce different kinds of products. The task to allocate and manage resources is rather complex [11], specially considering that the nature of the managed resource activities are concurrent, parallel, with synchronous and asynchronous behavior. Also, the managed resources may be shared, therefore needing conflict resolution strategies [3, 4, 21].
In an FMS a production route is physically possible when, considering a given set of resources, it leads to a product. Apart from the allocation of a resource, a control system for such a system, named supervisor, must be able to manage resources. To do so, the supervisor exchanges information (messages) with each managed resource [10, 18, 19]. Among other things, these messages carry the specification of the sub-product and status information. To promote this message exchange, the supervisor must be capable of programming the resource to operate as specified for each sub-product and recognize if the resource can be allocated to the sub-product under consideration. Also, it must recognize the end of a task and recognize a fault [1, 6]. When a resource fails, all the routes containing the resource must be disabled, leading in most cases to an inadmissible low level of production. In order to cope with faults, the supervisor must be able to reschedule routes containing the faulty resource.
In this paper we introduce an approach to systematically obtain the global model of an FMS based on Place/Transition Nets [15]. Since this model can be very large for complex systems, we show how this model can be reduced based on the concepts of Colored Petri Nets (CPN) [12] to obtain a reduced global model of the system, from the resources perspective. This CPN model is a general model in the sense that it is independent of production routes. We also introduce a fault tolerant model for such an allocation and management system. Fault tolerance must be considered with the objective to provide means by which the supervisor can recover itself from a fault. Also the design of such a supervisor must be kept as simple as possible. In order to accomplish these design goals, we structure the rescheduling of routes in order to consider three different kinds of situations: intra-cell rescheduling, inter-cell rescheduling, and rescheduling on the entry buffer.
Also considering the need of high availability and performance in order to guarantee the defined throughput for an FMS, the introduction of fault tolerance in the design of such a supervisor considers both forward recovery and backward recovery. For forward recovery we anticipate faults in the resources in a production route and reschedule the production routes for production orders before the faulty resource is reached. The backward recovery is considered at the level of a resource in such a way that when a faulty resource is fixed the operation restarts on the last consistent operation executed.
Considering formal methods to analyze and introduce fault-tolerant properties in computer systems, Petri nets are among the most applicable. This is because, using Petri nets, it is possible to unify the modeling of software, hardware and environmental aspects by using one formalism. Petri nets have been used as a formal method to analyze and introduce fault tolerant properties in the design of software systems [5, 7, 8,9, 13, 14, 16, 17].
The rest of this paper is organized as follows. In Section 2 we introduce some basic definitions for Flexible Manufacturing Systems as well as for Place/Transition nets and Colored Petri Nets. In Section 3 we detail the modeling approach adopted in this paper as well as how the structure of the model of an FMS based on Place/Transition nets can be reduced using CPNs. In Section 4 we discuss the introduction of fault tolerance in the design of the supervisor considering both forward and backward recovery by obtaining a fault-tolerant CPN model. Finally, in Section 5 we present conclusions.
2 Background Issues
In this section we introduce the basic definitions adopted in this paper for Flexible Manufacturing Systems, as introduced in [3, 4] and the basic concepts related to Place/Transition nets and Colored Petri Nets.
2.1 Flexible Manufacturing Systems
In Figure 1 the layout for an FMS and its main components are shown. As can be seen, the FMS consists of four manufacturing cells, each one with two machines. For each cell, for each machine and for the FMS there is a pair of buffers (entry buffers are identified by the prefix eb and output buffers are identified by the prefix ob). These buffers are used to store either raw-material (entry buffer for the FMS, eb), sub-products (all other buffers), and finished products (output buffer for the FMS, ob). In the rest of the paper the following definition for an FMS is adopted.
Figure 1: Layout example for an FMS
Definition 2.1 A Flexible Manufacturing System is 7-tuple (P, B,V, C, M, R, H), where:
1. P = {p_{1}, p_{2}, ... , p_{i}, ... , p_{n}} is a finite and non empty set of products.
2. B = {b_{1}, b_{2}, ... , b_{i}, ... , p_{n}}is a finite and non empty set of buffers.
3. V = {v_{1}, v_{2}, ... , v_{i}, ... , b_{n}} is a finite and non empty set of transport elements.
4. C = {c_{1}, c_{2}, ... , c_{i}, ... , c_{n}} is a finite and non empty set of cells.
5. M = {m_{1}, m_{2}, ... , m_{i}, ... , m_{n}} is a finite and non empty set of machines.
6. R = {r_{1}, r_{2}, ..., r_{i}, ... , r_{n}} is a finite and non empty set of resources.
7. H = {h_{1}, h_{2}, ... , h_{i}, ... , h_{n}} is a finite and non empty set of production routes.
A product p_{i } P_{ }is the result of raw material transformations from the entry to the end point of an FMS and a sub-product is an intermediate processing stage. A buffer b_{i } B is a region in the FMS used as storage and distribution point for sub-products.
A buffer b_{i } B is defined by: eb) entry buffer for the system storing raw material; ob) output buffer for the system, used to store all finished products; ebc_{i}) entry buffer for a cell c_{i } C, used to store sub-products; obc_{i}) output buffer for a cell c_{i } C, used to store sub-products; ebm_{i}) entry buffer for a machine m_{i } M, used to store sub-products; obm_{i}) output buffer for a machine m_{i } M, used to store sub-products.
In the example shown in Figure 1, the transportation elements belonging to the set V are the four robots (rc_{1}, rc_{2}, rc_{3}, and rc_{4}), and automated guided vehicles (AGV_{1} trough AGV_{n}). Robots are used to move sub-products within a manufacturing cell (intra-cell transport), and AGVs are responsible to move sub-products among cells and raw-material from the entry buffer of the FMS (eb) and finished products to the output buffer of the FMS (ob). The thicker grey line represents the route for the AGVs.
Each cell c_{i } C defines a region in the FMS which may contain one or more machines. Each machine m_{i }M may have more than one resource. A resource r_{i } R is that part of a machine allocated to process either a sub-product or raw material. Observe that P is the set of all products that can be manufactured based on the set of available resources.
Definition 2.2 A path defined by a finite sequence of resources, from the entry buffer in the system (eb) to the output buffer (ob) resulting in a given product p_{i } P is called production route, and is denoted by h.
For the example shown, the rest of the elements are identified as follows:
P = {p_{1}, p_{2}, p_{3}}, is the set of products.
B = {eb, ob, ebc_{1}, obc_{1}, ... , ebc_{4}, obc_{4},_{ }ebm_{1}, obm_{1}, ... , ebm_{8}, obm_{8}}, is the set of buffers.
C = {c_{1}, c_{2}, c_{3}, c_{4}}, is the set of cells.
M = {m_{1}, m_{2}, ... , m_{7}, ... , m_{8}}, is the set of machines.
R = {r_{1}, r_{2}, ... , r_{7}, ... , r_{8}}, is the set of resources.
H = {h_{1}, h_{2}, h_{3}}, is the set of production routes.
For instance h_{2} = r_{2} r_{4} r_{5} r_{7}, is a production route.
In order to illustrate the operation of the system, consider that the route h_{2} (shown in Figure 1 as a dashed line) results in the production of bolts (product p_{2}), as shown in Figure 2. To produce a bolt, five states are necessary:
1. Raw-material is transported to resource r_{2}, where it is processed and resulting in subproduct_{1}. In order to process the raw-material, the resource has to be programmed with the external radius a of the bolt and the width w. Therefore the data sent by the supervisor to the resource is (D_{p1} = (a),(w)).
2. subproduct_{1} is transported to resource r_{4} where it is processed and resulting in subproduct_{2}. The data sent to this resource by the supervisor is the length of the side of the bolt (D_{p2} = l).
3. subproduct_{2} is transported to resource r_{5} where it is processed and resulting in subproduct_{3}. The data sent to this resource by the supervisor is the internal radius of the bolt (D_{p3} = b).
4. subproduct_{3} is transported to resource r_{5} where it is processed and resulting in subproduct_{4}. The data sent to this resource by the supervisor is is the type of thread of the bolt (D_{p4} = N f).
5. subproduct_{4} is transported to output buffer (ob), yielding the finished product p_{2}.
Details related to the architecture supporting the control of an FMS, based on the above definitions can be found in [3, 4].
Figure 2: Bolt production
2.2 Place/Transition Nets and Colored Petri Nets
Definition 2.3 A Place/Transition net is a tuple N = (P, T; F, K, W, M_{0}), and is denoted by P/T net, where:
1. (P, T; F) is a net where P-elements are called places and T-elements are called transitions.
2. K : P {} is a capacity function.
3. W : F is a weight function.
4. M_{0} is an initial marking function satisfying : M_{0}(p) K(P).
A P/T net such that : K(p) = and : W (f) = 1 can be denoted simply by N = (P, T; F, M_{0}) and is called an ordinary Petri net.
Definition 2.4 Given a P/T N = (P, T;F, K, W, M_{0}) be a P/T net, the transition rule is defined as follows:
1. A function is called a marking of N iff .
2. A transition is enabled at M iff .
3. If is a transition which is enabled at a marking M, then t may occur, yielding a new marking given by the equation:
.
4. The occurrence or firing of t changes the marking M into the new marking , and is denoted by
5. is the (forward) reachability class, and is defined as the smallest set of markings of N such that , and if and for some , then
This firing rule determines the behavior of a P/T net in terms of system states (markings) and their changes. A marking is represent by the transpose of a column vector, e.g., , where is the marking of place It allows the simulation of the dynamic behavior of a system modeled by a P/T net. When a transition is enabled, it can fire or occur. When the transition occurs, tokens are removed from input places and placed in the output places.
Definition 2.5 A Colored Petri Net (CPN) [12] is a tuple , satisfying the requirements:
1. is a finite set of non-empty color sets
2. P is a finite set of places
3. T is a finite set of transitions
4. A is a finite set of arcs such that
5. N : is a node function
6. is a color function
7. EXPRESSIONS is a guard function, such that : [Type(G(t)) = BOOLEAN Type(Var(G(t))) ]
8. EXPRESSIONS is an arc expressions function such that : [Type(E(a)) = C(p(a))_{MS} Type(Var(E(a))) ] where p(a) is the place of N(a).
9. EXPRESSIONS is the initialization expression function such that : [Type(I(p))=C(p)_{MS} I(p) is closed]
It should be noted that the syntax and semantic of the language used to the net expressions are not presented, and it is assumed the existence of such a language, according to the same restrictions stated by Jensen [12] in the formal definition of CPN. The CPN-ML language as defined in [20] is used.
3 Modeling Procedure
Given an FMS as defined in Section 2 and the example shown, we now present the modeling procedure for the supervisor. Observing the layout in Figure 1, it is possible to see that a route is defined by segments (paths), and these segments may be paths among cells defined as inter-cell routes and the other segments are intra-cell routes.
Inter-Cell Routes are: T1) Raw-material deposited in the entry buffer eb for the system is distributed to the entry buffers ebc_{i} of any cell c_{i}; T2) Sub-products in the output buffer obc_{i} of a cell c_{i} can be transported to the output buffer ob of the system; T3) Sub-products in the output buffer obc_{i} of a cell c_{i} can be transported to the entry buffer ebc_{j} of any cell c_{i}.
Intra-cell Routes are: T4) Sub-products in the entry buffer ebc_{i} for any cell c_{i} are transported to the entry buffer ebm_{j} of any machine m_{j} in the cell c_{i}; T5) Sub-products in the output buffer obm_{j} of any machine can be transported to the output buffer obc_{i} of the cell c_{i}; T6) Sub-products in the output obm_{j} buffer of a machine m_{j} can be transported to the entry buffer ebm_{l} of another machine m_{l} in the same cell c_{i}.
Therefore, the supervisor must consider the type of routes (T1 to T6) as introduced above in order to model any route in the space of routes H for the FMS considered.
3.1 Top-Down Model of an FMS
A top-down modeling procedure is adopted to obtain the model for the supervisor. We consider three different models, namely, model for inter-cell routes, model for intra-cell routes, and model resource allocation. To obtain the model the following rules are employed:
Inter-Cell Routes (Rule 1): inter-cell routes are modeled according to the transport function as well as the buffers eb, ob, ebc, and obc. In Figure 3 showns the model for inter-cell routes. Places model these buffers, while transitions model the transport events among cells.
Intra-cell Routes(Rule 2): intra-cell routes are modeled according to the transport functions as well as the buffers ebc, obc, ebm, and obm. In Figure 4 it is shown the model for intra-cell routes. Places model these buffers, while transitions model the transport events among machines in a given cell.
Resource Allocation (Rule 3): the resources of the system are modeled, including the entry buffer ebm_{i} and output buffer obm_{i} for each machine. In Figure 5 the model for the resources is shown. Places model the buffers, while the transitions model the allocation and release of a given resource.
It is important to point out that in the case of the transitions for the models for inter-cell and intra-cell routes the events may or may not always generate commands to the transportation system. The routes define the behavior of the model for the supervisor and not necessarily of the transportation system, that is not modeled in this paper. This consideration is necessary when considering the recovery of the supervisor in the case of faults, as discussed later on. The global P/T model is shown in Figure 6, and is obtained by the fusion of places and transitions with the same name for the three models presented.
Figure 3: Model for inter-cell routes (rule1) for the FMS shown in figure 5
Figure 4: Model for intra-cell routes (rule2) for the FMS showm in Figure
Figure 5: Model for resource allocation (rule 3) for the FMS shown in Figure 5
Figure 6: Global P/T model
3.2 CPN Model
As can be seen from Figure 6, the structure of the model can be rather complex. Therefore, we introduce an approach to obtain a CPN model for the the allocation and management supervisor for an FMS. Basically we fold common parts in the structure of the Place/Transition net to obtain the equivalent CPN. For the example discussed in this paper the reduced model is shown in Figure 7. In this model, places and transitions have the following meaning:
Places: places PE and PS model the entry (eb) and output (ob) buffers for the system; places PEC and PSC model the entry (ebc) and output (obc) for the cells; places PEM and PSM model the entry (ebm) and output (obm) buffers for the machines. Places PA and PF model the status of a resource. A token in PA indicates that the resource is busy, and a token in PF indicates that the resource is free.
Transition: transition TEC represents the transport of sub-products or raw material from the entry buffer for the system (eb) to the entry buffer for the cells (ebc); transition TSC represents the transport of sub-products from the output buffer for the cells (obc) to output buffer (ob) for the system; transition TEM represents the transport of sub-products from the entry buffer for the cells (ebc) to entry buffer (ebm) for the machines; TSM represents the transport of sub-products from the output buffer for the machines (obm) to output buffer (obc) for the cell; TPC represents the transport of sub-products from the output buffer for the cells (obc) to entry buffer (ebc) for another cell; TPM represents the transport of sub-products from the output buffer for the machines (obm) to the entry buffer (ebm) for another machine; TER represents the allocation of a resource; TSR represents the release of a resource.
In order to obtain the CPN model we transform the production routes, formed by a list or resources ri in a list formed by the elements of the type (ci, ri, Dpi), where ci is the cell containing the resource ri, and Dpi represents the programming data specifying a certain subproduct_{i}. This list has the following definition:
List = [(c1, r1, Dp1), (c2, r2, Dp2), ...,(ck, rk, Dpk)]
The entry place for the net, that is place PE has an initial marking corresponding to the following information: (product1, List1) + (product2, List2) + + (productk, Listk), where productk specifies a production order on one item of product k, and Listk specifies the production route for product k. In the case of the example of Figure 3, we could have the following initial marking: (p3,[(c1, r1, Dp1),(c4, r8, Dp2)]). That is, the system has to produce one item of product p3.
Figure 7: Structure of the CPN for the global model
The color P is defined for all the places, except place PF whose color is R. The variables ci, and List are used to solve conflicts between transition TPM and TSM and transition TPC and TSC, respectively. In the case that a sub-product is transported to another machine in the same cell, that is ci = cj, then transition TPM occurs, otherwise transition TSM occurs. In case when a sub-product had used all the resources defined in its production route, that is List = nil, transition TSC occurs, otherwise transition TPC occurs, and the sub-product is transported to another cell. Observe that, in Figure 8, after the occurrence of transitions TPM and TSM, the head of the List (ci, ri, Dpi) is removed, indicating that the resource ri was already used. Also, transition TER only occurs if the guard [r = ri] is satisfied, that is, resource ri is free. Analogously, transition TSR occurs if the guard [ri = rm] is satisfied, that is the resource rm was released. When transition TER occurs, a resource ri is allocated to a given sub-product and a command or message with the data, Dpi, to program the resource is sent to it. Also, transition TSR occurs only if a resource is released. Therefore, the supervisor must look for a message of the type rm in order to be informed if the resource rm is no longer being used. These two operations can be seen as the synchronization between the supervisor and the resource and is represented by the dotted lines in Figure 8. Observe that this is not a part of the model.
4 Fault Tolerant Model
Considering that for each item to be produced a production order is placed to the FMS, represented by a token in place PE (see Figure 8), and for the system to deliver the best possible throughput, one must consider how to tolerate a resource failure along the production route defined in the token. This consideration guides our strategy to introduce forward recovery by anticipating these failures and rescheduling the production orders in the entry buffer eb for the FMS as well as for all sub-products stored in the buffers of the cells and/or resources (machines) along the production route. This approach guarantees that the raw-material and sub-products for a given set of production orders will not wait in the above-mentioned buffers while the resource that failed is not fixed. Based on this requirement, we structure the forward recovery by considering the rescheduling possibilities.
It is also important that as soon as a resource is fixed it must restart the processing either the raw-material or a sub-product in the last consistent operation. The objective of this backward recovery is to save raw-material.
Figure 8: CPN model for supervisor
4.1 Forward Recovery
Let r_{i} and be resources in the FMS such that , that is, r_{j} is a replica for r_{i} and r_{i} failed; we define four cases for route rescheduling as we discuss below. For all the four cases, the dashed lines correspond to the behavior of the supervisor, while solid lines represent the behavior of the transport system. It is important to point out that these two different routes, one for the supervisor and the other for the transport system, are necessary to keep the design of the supervisor with fault tolerance simple and efficient from the computational point of view.
4.1.1 Case 1
When the resources r_{i} and r_{j} are in the same cell and the route h directly includes r_{i} (see Figure 9). In this case all sub-products stored in buffer ebm_{i} are moved to buffer ebm_{j} (the entry buffer of the replica). The route h for each production order including the faulty resource r_{i} in the entry buffer for the cell (ebc_{i}) is rescheduled to the replica resource r_{j} by moving all the orders to the entry buffer of machine m_{j}.
Figure 9: Rescheduling for Case 1
4.1.2 Case 2
When the faulty resource r_{i} and its replica r_{j} are in the same cell and the route directly involves r_{i} (see Figure 10). In this case, the supervisor reschedule the routes involving the faulty resource to the replica. This rescheduling is accomplished by sending orders to the transport system to move all production orders from buffer ebm_{i} to the buffer ebm_{j}. Also, all the sub-products in the output buffer obm_{k} are rescheduled to the the buffer ebm_{j}. From the buffer obm_{j} each sub-product is transported to the output buffer of the cell c_{i} or to other machine in this cell.
Figure 10: Rescheduling for Case 2
4.1.3 Case 3
When the faulty resource r_{i} and its replica r_{j} are not in the same cell and the route directly involves r_{i} (see Figure 11). Then we have two scenarios, one shown in Figure 11.a and the other shown in Figure 11.b. For the first scenario, the production orders are rescheduled from the output buffer obc_{k} in a cell c_{k} to the cell c_{j} containing the replica resource r_{j} in the cell c_{j}, also all the sub-products already in the entry buffer ebc_{i }and the entry buffer for resource r_{i} in cell c_{i} are rescheduled to the entry buffer ebc_{j} of cell c_{j}. For the second scenario the production orders are rescheduled from the entry buffer for the system eb to the cell c_{j} containing the replica resource r_{j} in cell c_{j}, also all the sub-products already in the entry buffer ebc_{i }and the entry buffer ebm_{i} for resource r_{i} in cell c_{i} are rescheduled to the entry buffer ebc_{j} of cell c_{j}.
4.1.4 Case 4
For this case the faulty resource r_{i} and the replica r_{j} are in different cells and the route includes a resource r_{k} in the same cell c_{i} of the faulty resource r_{i} (see Figure 12). In this case all the sub-products in the output buffer obm_{k} of the resource r_{k} and in the input buffer ebm_{i} of machine m_{i} are rescheduled to the entry buffer ebc_{j }and to the entry buffer ebm_{j} of the replica resource r_{j} in cell c_{j}.
4.1.5 Rescheduling of Trajectories
Considering the possibility of having redundant routes in the system resulting in the same type of finished product. This case happens when some or all the resources defining a route are redundant. This fact serves to justify fault-tolerance for the resources of the system. In what follows we formalize the fault-tolerance concept.
Definition 4.1 Let be distinct resources belonging to an FMS, if r_{i} is a replica of s_{i}, then r_{i} can execute the same functions as s_{i}, that is
Definition 4.2 Let h_{i} be a route belonging to the route space of an FMS, the number of elements in h_{i} is
Definition 4.3 Let h_{u} and h_{v} be two different routes of an FMS, h_{v} is equivalent to h_{u}, denoted by iff: and and
Theorem 4.1 Let h_{u} = r_{1} ... r_{i}, ... r_{n} and h_{v} = s_{1}, ... s_{i} ... s_{n} be two different routes for an FMS, if , then there exists at least one resource s_{i}, such that
Theorem 4.2 Let h_{u} = r_{1} ... r_{i} ... r_{n} and h_{v} = s_{1} ... s_{i} ... s_{n} be two different routes for an FMS. If and h_{u} is k-resilient, then there exist at least k resources s_{i} such that , where
Theorem 4.3 Let h_{u} = r_{1} ... r_{i} ... r_{n} and h_{v} = s_{1 }...s_{i} ..._{ }s_{n} be two different routes for an FMS. If and , then where
As an example of the application of Theorem 4.3 let us consider the route h_{2} resulting in the product p_{2} (see Figure 1), that is h_{2} = r_{2}r_{4}r_{5}r_{7} p_{2}. Suppose that there exists in the route space H one route h_{v}= r_{2}r_{3}r_{5}r_{7} p_{2} such that Supposing that the resource r_{4} failed, the application of Theorem 4.1 implies r_{4} r_{3}, that is r_{3} is a replica for r_{4}. Therefore, according to Theorem 4.3 we have r_{2}r_{4}r_{5}r_{7} r_{2}r_{3}r_{5}r_{7}, and consequently r_{2}r_{3}r_{5}r_{7} p_{2}. Thus, route h_{2} may be rescheduled for the new one h_{v} = r_{2}r_{3}r_{5}r_{7}, resulting in the same product p_{2}. In Figure 13, we can see that the sub-products are transported from the buffer ebm_{4} to the buffer obm_{4}, without being processed by r_{4}, because it failed. From the buffer obm_{4} sub-products are transported to the buffer ebm_{3}, which is the entry buffer for the resource r_{3}, that is a replica for r_{4}. Compare route h_{v} shown in Figure 13 with route h_{2} shown as a dashed line in Figure 1.
4.2 Fault Tolerant CPN Model
In order to be fault-tolerant, the supervisor must re-cognize when a resource failed and reschedule all the routes involving it according to the four cases previously discussed. The supervisor must also be able to detect when the resource are fixed so that it can be considered again in a given route.
At any instant of time, we may have in any place of the CPN model, (except place PF), tokens with the field (p,((c_{i}, r_{i}, s_{i}, D_{pi}) :: List)).
In order to implement the fault-tolerant supervisor, we assume that any resource can execute the following functions:
1. Serve as an interface to the supervisor.
2. Receive the programming data D_{pi}.
3. Reinitialize the resource r_{i} after it has been recovered from a fault.
4. Send messages to the supervisor in order to inform the status s_{m} of the resource.
5. Send messages to the supervisor informing that a resource r_{m} has finished a task and is free.
Considering the model for the fault-tolerant supervisor, when any of the transitions TER, TFO, and TSR occur, the following takes place:
1. When transition TER occurs a resource r_{i} has completed its operation, therefore a message m_{s0} (r_{i}, D_{pi}) is sent when TER occurs, where D_{p} are the programming data for the resource r_{i} specifying a given sub-product.
2. The transition TFO occurs only when a message with format m_{go} (r_{m}, s_{m}) is received.
3. Upon receiving a message with format m_{g1} (r_{m}), indicating that the resource finished the operation, transition TSR occurs.
In order to tolerate faults, each place, except PF, must get a token with the following information:
Field P: specifies an element that is the type of product to be manufactured.
Field L: contains a list of elements (c_{i}, r_{i}, s_{i}, D_{pi}), where:
1 c_{i} specifies the cell containing the resource r_{i}.
2 s_{i} specifies the status of an operation. When s_{i} = 0 at the end of an operation, that resource completed the operation successfully. Otherwise, s_{i} = 1, implying that the resource failed. This indicates to the supervisor that it should reschedule routes involving this resource.
3 D_{pi} is the programming data as discussed before.
The fault tolerant CPN model is shown in Figure 14, where places and transitions have the same meaning and the color sets and variables are as declared for the model shown in Figure 8. Places PAR and PVS and transitions TET and TET1 have the following meaning:
PAR: a token in this place indicates that a resource is allocated for an operation.
PVS: a token in this place indicates that a resource has finished its operation and is waiting to be released.
TET: the occurrence of this transition indicates that the resource has failed. Therefore the routes involving it must be rescheduled according to the arc function frmm . This transition occurs only if the guard is evaluated to be true.
Figure 11: Rescheduling for Case 3
Figure 12: Rescheduling for Case 4
TET1: this transition, together with the place PVS and the output arc function frcc reschedules sub-products from the entry buffers from a cell with a faulty resource to a different cell with the replica.
The function frmm inserts in the head of list the element containing the resource r_{j} that is a replica of resource r_{i}. The occurrence of the transition TET deposits a token in place PSM which is the entry place for transitions TSM and TPM. The occurrence of any one of these transitions removes the head of the list, then the next resource to be allocated will be r_{j}. Observe that the occurrence of transition TET removes tokens from place PEM and deposits tokens in place PSM. Thus, in the case of a resource failure, the sub-products cannot access the resource.
We have detailed the model of the supervisor considering faults within a cell (for Case 1). We do not detail the rescheduling of routes for the remaining three cases considered in this paper.
It is important to point out that the rescheduling of a route in the supervisor does not correspond to commands for the transportation system. Commands are sent to transportation system only when a valid route is defined, so that the faulty resource is bypassed. In the example discussed, the command for the transportation system will be to move parts from the entry buffer ebm_{4} of machine m_{4} to the entry buffer ebm_{3} of machine m_{3}, and also from the entry buffer ebc_{2} for cell c_{2} to the entry buffer ebm_{3} of machine m_{3} instead of the entry buffer of machine m_{4}.
Figure 13: Rescheduling of route h_{2} due to a fault in r_{4}
Figure 14: Fault tolerant CPN model
4.3 Backward Recovery
During the production, the resource periodically establishes checkpoints for the current operation. In this case, the checkpoints are necessary in order to guarantee that a a faulty resource after repair continues the operation from the most recent checkpoint whenever this is possible. In order to illustrate this checkpoint mechanisms consider Figure 15, where it is assumed that the resource r_{4} had failed while manufacturing subproduct_{2}. Observe that sides a, b, and c of subproduct_{2} were finished before the failure. As shown in this figure, the failure had occurred while starting to cut the face of subproduct_{2}. Let us assume that a checkpoint is made whenever a face is cut, then when a resource fails and it is afterwards fixed, the operation restarts from this checkpoint.
Figure 15: Back-up data for checkpoint for resource r_{4}
5 Conclusion
We have proposed an approach for modeling the supervisor for Flexible Manufacturing Systems (FMS). The approach is based on the concepts of routes and Petri nets.
The concepts introduced in this paper have been exemplified using a manufacturing system and the models with and without fault-tolerance have been verified using the Design-CPN [12] environment. Based on this verification, we were able to certify the correct direction of the proposed approach. Details related with the verification were omitted due to space limitations.
The proposed approach allows the designer to control the complexity of the description of the model of a supervisor for an FMS. We have shown that this model can be very complex when using Place/Transition nets. To overcome this problem we have shown how Colored Petri nets can help in obtaining a more compact model with the same desired behavior.
Considering the necessity to deal with faults, we have introduced an approach to introduce fault tolerant characteristics in the model of the supervisor, based on resource replicas and route rescheduling. The objective is to guarantee that the system can continue delivering the specified services even in the presence of resource failures. Two cases were considered: forward recovery and backward recovery.
Current investigations are on the integration of the transportation system model to the supervisor, also considering fault tolerance and in detailing a methodology to model a supervisor for an FMS.
References
[1] | Adlemo A., Andreasson S. A., and M. I. Johansson M.I. Fault tolerance strategies in an existing fms instalation. Control Engineering Practice, 1(1):127 - 134, 1993. |
[2] | Zimmermann A. Modeling of manufacturing systems and production routes using colored petri nets. Proc. of the 3rd IASTED Int. Conf. on Robotics and Manufacturing, Cancun, Mexico, pp 380 - 383, 1995. |
[3] | T.C. Barros, A. Perkusich, and J.C.A. de Figueiredo. Alocação de recursos e tolerância a faltas em sistemas flexíveis de manufatura utilizando redes de petri coloridas. In Anais do VII Simpósio Brasileiro de Computadores Tolerantes a Falhas, pp 153 - 167, Campina Grande, PB, Brasil, July 1997. |
[4] | T.C. Barros, A. Perkusich, and J.C.A. de Figueiredo. A Colored petri net based approach for resource allocation and fault tolerance for flexible manufacturing systems.In Proc. of 2nd Workshop on Manufacturing and Petri Nets, 18th Int. Conference on Application and Theory of Petri Nets, pp 77 - 96, Toulouse,France, 1997. |
[5] | F. Belli and K.-E. Grosspeitsch. Specification of fault-tolerant systems issues by predicate/transitions nets and regular expressions-approach and case study. IEEE Transactions on Software Engineering, 17(6):513 - 526, 1991. |
[6] | P.R. Chintamaneni, P. Jalote, Y.B. Shieh, and S.K. Tripathi. On fault tolerance in manufacturing systems. IEEE Network, 2(3):32 - 39, 1988. |
[7] | F.A. de Figueiredo, J.C.A. de Figueiredo, A. Perkusich, and F.M. de Assis. Tolerância a falhas em sistemas de software utilizando códigos convolucionais. In Anais do VII Simpósio Brasileiro de Computadores Tolerantes a Falhas, pp 195 - 209, Campina Grande, PB, Brasil, 1997. |
[8] | J.C.A. de Figueiredo and A. Perkusich. Faults and timing analysis in real-time distributed systems: A fuzzy time petri-net-based approach. International Journal Fuzzy Sets and Systems, 83(2):143 - 168, 1996. |
[9] | R. de Lemos, A. Saeed, and T. Anderson. Analysis of timeliness in safety-critical systems. In J. Vytopil, editor, Formal Techniques in Real-Time Fault-Tolerant Systems. Lecture Notes in Computer Science 571, pp 571 - 592. Springer-Verlag, 1992. |
[10] | B. Lennartson and M. Fabian. Control of manufacturing systems: An object oriented approach (revised version). Technical Report R91 - 18, Chalmers University of Technology, Control Engineering Laboratory, Gotenborg, Sweden, 1991. |
[11] | L. Alexander, M. Neville and H. Baosheng. Task decomposition and allocation problems and discrete event systems. Pergamon, Automatica, 30(2):203 - 216, 1994. |
[12] | K. Jensen.Colored Petri Nets: Basic Concepts, Analysis, Methods and Practical Use. EACTS - Monographs on Theoretical Computer Science. Springer-Verlag, 1992. |
[13] | N.G. Levenson. Software safety: Why, what, and how. ACM Computing Surveys, 18(2):125 - 163, June 1986. |
[14] | N.G. Leveson and J.L. Stolzy. Safety analysis using petri nets. IEEE Transactions on Software Engineering, SE-13(3):386 - 397, March 1987. |
[15] | T. Murata. Petri nets: Properties, analysis and applications. Proc. of the IEEE, 77(4):541 - 580, April 1989. |
[16] | A. Perkusich, J.C.A. de Figueiredo, and S.K Chang. Embedding fault-tolerant properties in the design of complex systems. Journal of Systems and Software, 2(25):23 - 37, 1994. |
[17] | Y. Shieh, D. Ghosal, P.R. Chintamaneni, and K. Tripathi. Application of petri net models for the evaluation of fault-tolerant techniques in distributed systems. Technical Report Series CS-TR-2128, University of Maryland, College Park, Maryland, 20742, USA, October 1988. |
[18] | M. Silva. Las Redes de Petri: en la Automática y la Informática. Editorial AC, 1985. |
[19] | M. Silva and R. Valette. Petri nets and flexible manufacturing.In Lecture Notes in Computer Science, pp 374 - 417. Springer-Verlag, 1989. Advances in Petri Nets. |
[20] | University of Aarhus, Aarhus, Denmark. Design CPN - Overview of CPN ML Syntax, version 3.0, 1996. |
[21] | R. Valette, M. Corvousier, and C. Desclaux. Putting petri nets to work for controlling flexible manufacturing systems. In Proc. of IEEE International Symposium on Circuits and Systems, ISCAS 85, Kyoto, Japan, 1985. |
^{*}^{ }The first author is a Doctorate student at COPELE/DEE/CCT/UFPB. The authors would like to thank the financial support of CAPES as a scholarship for the first author, and to CNPQ for the partial financial support in the form of grants 300722/90-7 and 300904/94-0 for the second and third authors.